9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
Size

25KB
MD5

539f157ec1c1550ecd68a1c5763553f3
SHA1

75717a9c12a77d4667bde760d5df37794c012b42
SHA256

9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777
SHA512

eddff6ea8ee1567865adf47ee1ffa6361f44e7aed13c0a8518c80382f488e229698030112f5478a16afc916bafff2f1dbaac55bb72bd562d46c550a918fb4e85
SSDEEP

384:QOlIBXDaU7CPKK0TIhfJJ1Evd5BvhzaM9mSIEvd5BvhzaM9mSsxmMxm9+9qQ+5Ce:kBT37CPKKdJJ1EXBwzEXBwdcMcI9c

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (4163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/files/0x0002000000010617-6.dat	upx
behavioral1/memory/3044-75-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Cayenne.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\msdatl3.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_ja.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\CAPSULES.INF.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Defender\MsMpCom.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Karachi.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1CORE.DLL.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\desktop.ini.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\Proof.XML.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Resources.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODEXL.DLL.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\msadco.dll.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe

C:\Users\Admin\AppData\Local\Temp\9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe
"C:\Users\Admin\AppData\Local\Temp\9b4e1af656776ef32c46d154bd2a2717ecded96889b97279cd588a784c85c777.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
25KB

MD5
5122d5cb7a4d81c01f7ef9905a0d2795

SHA1
25d1791b3d492d64ed91fb7f235cde3203d849af

SHA256
904d1dfbd06ecd6317c66cd5b53334a045545f0fde40438153ab90e61d66b72f

SHA512
d8c9a5886c618a375eca345a992c64b9e084aea74a6b46143f27bb2d8c83d917fea890ae8164fbbcca1cd7b3d0287ac5202ed165aea4ab0726adc775d987ebe5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
34KB

MD5
cd07744ac055020e59683775fc9d76a2

SHA1
3a29d1f5a5b0301e476cf5be27be0c7ff534cfbb

SHA256
6b5f79b9d9ef8e558646faeee9f61e46a4a10ba461fad07eecc7f8f21db7371a

SHA512
5a99ff8915275362bfe2887cf5980b431f3d2505e2bfe3c1b6346add0c8415460dc3e8803fa8b56026a6c94ccd3289c990a283a8fbc1250e020137268f59d8b5

Download Submit
memory/3044-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3044-75-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download